Domain Fronting Cloudflare Sni Host Mismatch

Renata Cardoso@rcardososec

•updated Aug 26, 2026•2•0•5

Detects domain fronting abuse of Cloudflare CDN where the TLS SNI (outer front domain) differs from the inner HTTP Host header actually requested, a technique used to smuggle C2 traffic behind a trusted Cloudflare-fronted domain